PT-2019-11196 · Apache · Airflow

Publicado 2019-01-23 · Atualizado 2019-04-12 · CVE-2019-0216

Positive Technologies (AI Summary)

CVSS v2.0

8.5

Alta

Vetor base

AV:N/AC:M/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Airflow (affected versions not specified)

Description: A malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

XSS

Enumeração de Fraquezas

CWE-284

CWE-79

Identificadores relacionados

BDU:2019-04409

CVE-2019-0216

GHSA-8P7V-2JVJ-V54R

PYSEC-2019-214

Produtos afetados

Airflow

Referências · 25

• https://github.com/apache/airflow · Nota
• https://github.com/apache/airflow/commit/73280e489c8a766264f2dd9225c3c899f31be758 · Nota
• https://github.com/apache/airflow/commit/a7d8fe64a15b9c228654441166a5ba85d0a5f8ef · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2019-214.yaml · Nota
• https://abf.rosa.ru/advisories/ROSA-SA-2025-2899 · Nota
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/EZRMTEIGZKYFNGIDOTXN3GNEJTLVCYU7 · Aviso do Fabricante
• http://securityfocus.com/bid/107869 · Nota
• http://openwall.com/lists/oss-security/2019/04/10/6 · Nota
• https://web.archive.org/web/20200227081055/http://securityfocus.com/bid/107869 · Nota
• https://osv.dev/vulnerability/GHSA-8p7v-2jvj-v54r · Aviso do Fabricante
• https://github.com/advisories/GHSA-8p7v-2jvj-v54r · Nota
• https://abf.rosa.ru/advisories/ROSA-SA-2025-2900 · Nota
• https://bdu.fstec.ru/vul/2019-04409 · Nota de Segurança
• https://oracle.com/technetwork/topics/security/public-vuln-to-advisory-mapping-093627.html · Nota
• https://abf.rosa.ru/advisories/ROSA-SA-2025-2859 · Nota